Monitoring redundant components

ABSTRACT

A device for monitoring a component has at least one processor core and a further processor core. The device further includes a determining unit configured to determine a profile of the processor core, the profile being influenced by an input signal applied to the processor core, and to determine a further profile of the further processor core, the further profile being influenced by a further input signal applied to the further processor core. The device further includes a comparison unit configured to compare the profile and the further profile and to generate a fault signal, if a comparison result of a comparison carried out by the comparison unit indicates defective similarity of the profile to the further profile.

The present patent document is a § 371 nationalization of PCTApplication Serial Number PCT/EP2014/062809, filed Jun. 18, 2014,designating the United States, which is hereby incorporated byreference, and this patent document also claims the benefit of DE 102013 214 398.2, filed on Jul. 23, 2013, which is also herebyincorporated by reference.

TECHNICAL FIELD

The present embodiments relate to the technical field of monitoring of acomponent including at least one processor core.

BACKGROUND

In industrial communications, a correct function is of highestimportance. This applies, in particular, in safety-critical controlsystems (e.g., railroad automation, energy network automation,production automation, process automation).

“Power fingerprinting” for detecting manipulated devices is known, forexample, from WO 2012/061663. Here, the power consumption of a device isanalyzed and compared with a reference power consumption profile inorder to detect a malfunction or a manipulation through malware.

Self-monitoring of a gateway is known from patent application DE 10 2011007 387. A check is carried out here to determine whether acorresponding incoming data packet has been received for an outgoingdata packet. It may thereby be provided that a gateway does not itselfgenerate data packets in the event of a malfunction.

An encryption component with self-monitoring is known from patentapplication DE 10 2011 078 309. This provides a switching signal if aVPN tunnel has been correctly set up.

A safety computing platform is known, in which a safety monitor circuitCIC61508 monitors a main processor and the software execution on themain processor. It may, in particular, carry out tests against fixedtest patterns and compare results of two independent executions. (seehttp://www.infineon.com/dgd1/Safety-Computing-Platform-XC2300-CIC61508-Product-Brief.pdf?folderId=db3a304317a748360117f45a9c863e84&fileId-db3a3043353fdc16013543303497315d.)Features are also described in:http://www.infineon.com/cms/de/product/microcontrollers/companion-ic-family/cic61508-signature-watchdog/channel.html?channel=db3a30432dbf3762012dc800293d362b.

Multi-channel processors are known from the safety environment. In theprocessors, a calculation is performed in hardware with multipleredundancies. Coded processing is furthermore known in which the samecalculation is performed on hardware with differently coded data.

The calculation of the cross-correlation between two signals is a knownmethod for signal processing. It is used, e.g., in receivers in order todecode a signal (see, e.g.,http://www.iitrc.ac.in/outreach/web/CIRCIS/PG/AVN/SP/Digital%20signal%20processing.pdf slide 44ff.,http://pollux.dhcp.uia.mx/manuales/Filtros/UIA_correlation.pdf,http://dsp-book.narod.ru/DSPCSP/14.pdf).

Fault signaling contacts are furthermore known. These contacts indicatethe failure of a device by a change of status (e.g., open/closed), forexample, in the event of loss of the voltage supply or in the event ofinternal faults. This contact is wired separately from the communicationlines (e.g., Ethernet or the like) and enables a status determinationeven if the device may no longer respond to inquiries via thecommunication line.

Protection against random and also systematic faults is provided throughsuitable safety measures. However, protection against deliberate attacks(e.g., IT security) is also required to an increasing extent. The aim,however, is to provide that established safety mechanisms are notinfluenced by security measures.

SUMMARY AND DESCRIPTION

A need exists for effective information technology (IT) securitymeasures that are suitable for control environments. The underlyingobject of the present embodiments is to meet this need.

The scope of the present invention is defined solely by the appendedclaims and is not affected to any degree by the statements within thissummary. The present embodiments may obviate one or more of thedrawbacks or limitations in the related art.

According to a first aspect, a method for monitoring a component isprovided. The component includes at least one processor core. Accordingto the method, an input signal is applied to the processor core. Afurther input signal is applied to a further processor core. A profileof the processor core influenced by the application of the input signalto the processor core is determined. A further profile of the furtherprocessor core influenced by the application of the further input signalto the further processor core is determined. The profile and the furtherprofile are compared. An insufficient similarity between the profile andthe further profile is interpreted as an indication of a malfunction ofthe component. In particular, it may thus be detected, for example,whether the monitored component is manipulated.

According to a further aspect, a device for monitoring a componenthaving at least one processor core is provided. The device includes thecomponent to be monitored, a further processor core, a determinationunit and a comparison unit. The determination unit is designed todetermine a profile of the processor core. The profile is influenced byan input signal applied to the processor core. Furthermore, thedetermination unit is designed to determine a further profile of thefurther processor core. The further profile is influenced by a furtherinput signal applied to the further processor core. The comparison unitis designed to compare the profile and the further profile and togenerate a fault signal if a comparison result of a comparison carriedout by the comparison unit is an insufficient similarity between theprofile and the further profile.

BRIEF DESCRIPTION OF THE DRAWING

FIG. 1 depicts a two-channel processor with two processor coresaccording to one embodiment.

DETAILED DESCRIPTION

FIG. 1 depicts a device 1 designed as a monitoring unit according to oneembodiment. The monitoring unit 1 includes a component 2 to bemonitored, a determination unit 4, and a comparison unit 5. Thecomponent 2 includes a processor core 2 a and a further processor core 2b. The monitoring unit 1 is suitable for monitoring the component 2 orthe processor core 2 a and/or the processor core 2 b. Since themonitoring unit is designed to monitor the component 2, it is alsodesigned to at least partially monitor the monitoring unit 1.

Furthermore, the monitoring unit 1 also includes an energy unit 7, forexample, a transformer that transforms the voltage of an externalelectrical energy supply 9 to a suitable voltage level and supplies itto the component 2 or to the processor cores 2 a, 2 b.

The determination unit 4 is designed to determine a profile of theprocessor core 2 a influenced by an input signal 3 a applied to theprocessor core 2 a and to determine a further profile of the furtherprocessor core 2 b influenced by a further input signal 3 b applied tothe further processor core 2 b. In the present example embodiment, theinput signals 3, 3 a, 3 b are identical and are applied simultaneouslyto both processor cores via the same line. In alternative exampleembodiments described below, the input signals 3 a and 3 b are notidentical.

According to the embodiment depicted in FIG. 1, the determination unit 4includes a current-measuring unit 4 a designed as a sensor 4 a and afurther current-measuring unit 4 b designed as a further sensor 4 b. Thecurrent-measuring unit 4 a is designed to determine the profile of theprocessor core 2 a, whereas the current-measuring unit 4 b is designedto determine the further profile of the further processor core 2 b.

According to the embodiment depicted in FIG. 1, the comparison unit 5includes a cross-correlator 5 a designed to perform a cross-correlationof the profile and the further profile and supply the result of thecross-correlation to a comparator 5 b. The cross-correlator 5 a issimilarly part of the comparison unit 5. The comparator 5 b compares theresult of the cross-correlation with a threshold value 8. If the resultof the cross-correlation exceeds the threshold value 8, and it may beinferred therefrom that the profile and the further profile aresufficiently similar, e.g., they correspond sufficiently to one another.This sufficient similarity between the profile and the further profileis interpreted as an indication of a fault-free operation of thecomponent 2. Conversely, if the result of the cross-correlation fallsbelow the threshold value 8, it may be inferred therefrom that theprofile and the further profile do not correspond sufficiently to oneanother, e.g., the similarity between the profile and the furtherprofile is therefore insufficient. This insufficient similarity betweenthe profile and the further profile is interpreted as an indication of amalfunction of the component 2. The comparison unit 5 is thus designedto compare the profile and the further profile and generate a comparisonresult on the basis of the comparison. If the comparison result of acomparison carried out by the comparison unit 5 is an insufficientsimilarity between the profile and the further profile, this isinterpreted as an indication of a malfunction of the component 2, forexample in that the comparison unit generates a fault signal 6 as astatus signal.

In other words, FIG. 1 depicts a two-channel (e.g., dual-lane) processor1 with two CPUs 2 a, 2 b. A safety watchdog, which, for example,compares the calculation results of the two channels 2 a, 2 b, may alsobe present.

According to the embodiment depicted in FIG. 1, a sensor 4 a, 4 b isprovided for each channel 2 a, 2 b, which measures the currentconsumption of the respective channel 2 a, 2 b and in each case outputsa signal including the respective current consumption profile. These twosignals are made available to the cross-correlation unit 5 a thatdetermines the cross-correlation of the two current consumptionprofiles. This may be performed, for example, by a Digital SignalProcessor (DSP) or Field-Programmable Gate Array (FPGA). The result iscompared with a fixed or predefinable threshold value 8. If thethreshold value 8 is exceeded, a normal operational state prevails,e.g., the two channels 2 a, 2 b indicate a sufficiently similar currentcharacteristic profile. This may be supplied as a status signal 6.

In a different variant, for example, if the threshold value 8 isunderstepped, a reset is triggered (e.g., by supplying a correspondingsignal to a safety watchdog) or output modules to which control signalsare supplied are switched to an inactive state (e.g., high-impedance or0V or to an invalid output value).

Different sensors or a plurality of sensors of a channel 2 a, 2 b mayalso be provided. One, both, or all of the CPUs 2 a, 2 b may in eachcase also have an integrated sensor that measures the currentconsumption profile. A multi-core CPU may provide one sensor for eachcore and an integrated correlation unit 5 a and an integrated thresholdvalue comparison unit 5 b. A multi-channel CPU (e.g., multi-core CPU)may thereby internally compare a plurality of processor cores. Thecurrent consumption of further components of a channel, (e.g.,input/output modules, communication interfaces, memory modules), mayalso be measured. In one variant, the comparison unit 5 (including thecross-correlation unit 5 a and the comparison unit 5 b) is configurable,and the processor cores to be monitored may be specified. If, forexample, 4 processor cores (Core0, Core1, Core2, Core3) are provided, itmay be configured, for example, that Core0 and Core3 are to be checked.In certain embodiments, more than two channels may be monitored. Thus,for example, Core0, Core1, and Core3 may be monitored in order todetermine whether their current consumption/radiation profiles are ineach case sufficiently strongly correlated in pairs.

The alarm designed as a fault signal may be transmitted, for example,via the cabling of the fault signaling contact in that the comparator 5b similarly provides its own fault signaling contact connected in serieswith the fault signaling contact of the device. A signal via the cablingof the fault signaling contact then means that either the device hasfailed or the comparator has detected an anomaly (or bothsimultaneously). A distinction cannot be made, however, between thesepossibilities since only 1 bit may be transmitted. If a distinctionbetween the alarm of the comparator and a device failure is desired, thefault signaling contact of the comparator is connected via its owncabling to a monitoring device.

According to one embodiment, the first starting point is the known powerfingerprinting in which an actual current consumption is compared with areference pattern. The second starting point is a safety watchdog thatchecks the similarity of the two data results.

According to the embodiment depicted in FIG. 1, it is thus proposed tocompare the current consumption profile of at least two redundantimplementations of current consumption profiles of the two processorcores 2 a, 2 b through cross-correlation. A safety monitor is therebyimplemented, not at data level, but at current consumption level. Asafety monitor monitors a computing system 1, 2. If an illegal state isdetected, an alarm signal, for example, may be supplied as a statussignal 6. The monitoring unit 1 or an external system monitored by themonitoring unit 1, the component 2 or by the monitoring unit 1, or bythe component 2, may be made to perform a restart, (e.g., a reboot), ormay be switched to an intrinsically safe state. In particular, faultattacks, also referred to as fault injection attacks, are thussignificantly hindered, since both processor cores 2 a, 2 b ismanipulated for a successful attack in such a way that they have anidentical fault behavior. In one variant, the first processor core 2 aand the second processor core 2 b are tamper-protected with differentmeasures (e.g., no additional protection, casting with epoxy resin,fitting of a protective metal sleeve on the motherboard). This offersthe advantage that an attacker may have to bypass the different tamperprotection measures simultaneously for an unnoticed attack.

According to the embodiment depicted in FIG. 1, the cross-correlation(e.g., peak) exceeds a predefinable threshold value in order to detect acorrect operation. In a different variant, both the autocorrelationfunction and the cross-correlation function are calculated. Depending onthe autocorrelation (e.g., peak), the threshold value is determined,e.g. 0.5*peak_autocorrelation or 0.7*peak_autocorrelation. In onevariant, time shift information, (e.g., the temporal position of themain peak), is furthermore determined through cross-correlation. Acorrect operation is identified if the time shift determined in this waylies within a predefinable time interval.

In a further variant, if no common clock is present for the tworedundant processor cores 2 a, 2 b, the clock generation of the tworedundant processor cores 2 a, 2 b is adjusted. The time shift may bedetermined by the cross-correlation of the current consumption. The timeshift serves as the input of a control loop for the clock generation. Atemporal drifting apart of two identical, redundant processor cores 2 a,2 b in each case with autonomous clock generation may thus be prevented.

The example embodiment depicted in FIG. 1 discloses a device 1 for themonitoring (e.g., automatic monitoring) of a component 2. The component2 includes at least one processor core 2 a. The device 1 includes thecomponent 1 and/or 2 to be monitored, a further processor core 2 b, adetermination unit 4 and a comparison unit 5. The determination unit 4is designed to determine a profile of the processor core 2 a. Theprofile is influenced by an input signal 3 a applied to the processorcore 2 a. The determination unit 4 is furthermore designed to determinea further profile of the further processor core 2 b. The further profileis influenced by a further input signal 3 b applied to the furtherprocessor core 2 b. The comparison unit 5 is designed to compare theprofile and the further profile and generate a fault signal 6 as astatus signal if a comparison result of a comparison carried out by thecomparison unit 5 is an insufficient similarity between the profile andthe further profile.

According to one example embodiment, the component 2 and/or the device 1may be automatically monitored according to the following method. Aninput signal 3 a is applied to the processor core 2 a. A further inputsignal 3 b is applied to the further processor core 2 b. A profile ofthe processor core 2 a influenced by the application of the input signal3 a to the processor core 2 a and a further profile of the furtherprocessor core 2 b influenced by the application of the further inputsignal 3 b to the further processor core 2 b are (e.g., automatically)determined. The profile and the further profile are (e.g.,automatically) compared. An insufficient similarity between the profileand the further profile is (e.g., automatically) interpreted as anindication of a malfunction of the component, for example through theoutput of a status signal 6 designed as a fault signal.

If the comparison reveals a sufficient similarity between the profileand the further profile, this is (e.g., automatically) interpreted as anindication of a fault-free operation of the component 1 or 2. Thecomparison unit 5 may be designed to generate no fault signal as astatus signal 6 if a comparison result of the comparison carried out bythe comparison unit 5 is a sufficient similarity between the profile andthe further profile. The comparison unit may output no status signal ora status signal 6 that indicates that the comparison unit 5 hasidentified no fault in the component 2.

The determination unit 4 may include a current-measuring unit 4 a, 4 bor a current-measuring unit for the processor core 2 a and/or thefurther processor core 2 b. The profile and the further profile thusinclude or are in each case a variation with time in the power input ora current consumption profile of the respective processor core 2 a, 2 b.The measurement of the power input or the current consumption profile ofthe respective processor core may be determined, for example, byelectromagnetic radiation of the respective processor core or a shuntfor the respective processor core.

According to one embodiment, the comparison unit 5 includes across-correlator 5 a and a comparator 5 b. The cross-correlatordetermines the cross-correlation of the determined profile of theprocessor core 2 a and the determined profile of the further processorcore 5 b. The comparator compares the result of the determinedcross-correlation with a threshold value 8. If the result of thedetermined cross-correlation is less than the threshold value, this isinterpreted as a malfunction of the component 2 in that a fault signalis supplied as a status signal 6. The comparison unit 5 is thus designedto carry out the comparison by a determination of a cross-correlation ofthe profile and the further profile. Alternatively, the comparison mayalso be carried out by a different feature extraction, such as, forexample, by a comparison of the mean values and/or the peak valuesand/or the frequency spectrum of the profile and the further profile.The measured time profile, for example, is transformed (e.g., with FTTFourier transformation) and the transformed signal is analyzed. Thecross-correlator 5 a and the comparator 5 b do not necessarily have tobe integrated in a comparison unit 5 designed as a uniform component, asdepicted in FIG. 1. The comparison unit 5 may also include across-correlator 5 a designed as a separate component and a comparator 5b designed as a separate component.

According to one embodiment, the insufficient similarity between theprofile and the further profile is determined by a threshold value. Adegree of similarity, for example, is determined, the determined degreeof similarity is compared with the threshold value and, if the thresholdvalue is exceeded or understepped, a fault signal is supplied.

According to one embodiment, as in the example embodiment depicted inFIG. 1, the signals 3 a, 3 b applied to the processor core 2 a and tothe further processor core 2 b are identical and/or simultaneous. Theadvantage of an identical signal 3 on both processor cores 2 a, 2 b (incontrast, for example, to a comparison of a current consumption profileof the processor core with a stored reference current consumptionprofile) is that the same signal is present on both processor cores andtherefore a difference between the profiles of the two processor coresindicates with a high probability a malfunction of the component 2. Inother words, it is then irrelevant which input signal is applied and thethreshold value 8 at which a malfunction of the component 2 isestablished may be set lower.

According to a further embodiment, the input signal 3 a and the furtherinput signal 3 b are coded differently, but may have the same content.In such a case, it may be expected that the two processor cores behaveidentically apart from the decoding work, thereby still allowing a lowerthreshold value 8 than in the case of a comparison of the profile with areference profile stored on a different input signal. The advantage ofthe different coding (e.g., coding as bitwise inverse value, ascomplementary value or as masked value, e.g., addition and/ormultiplication with masking value) is that specific hardware faults maybe detected (e.g., one bit is set to 0 or 1).

In a further variant, a permanently stored replacement signal 3 b isselected depending on the input signal 3 a. This has the advantage thatattacks that cause malfunction due to invalidly coded input signals maybe detected since only stored and therefore reliably validly coded inputsignals may be supplied to the second component.

The input signal applied to the first processor core and the inputsignal applied to the second processor core may be appliedsimultaneously (e.g., as depicted in FIG. 1) or, on the other hand,time-shifted (e.g., delayed). The advantage of a simultaneousapplication of a (e.g., identical) signal to both processor cores 2 a, 2b is that the result may be determined in real time. The advantage of atime-shifted application is that a temporary fault caused, e.g., byelectromagnetic irradiation may be detected if the input signal isprocessed with a time delay, e.g., if the fault takes effect atdifferent times of the input signal, and therefore the cross-correlationof the profile and the further profile is reduced.

The comparison unit 5 may be designed to determine a time shift betweenthe profile and the further profile. In this embodiment, theinsufficient similarity is established if the determined time shiftexceeds a time shift threshold value 8. The advantage of this embodimentis that a temporal malfunction may be detected. In control systems, notonly is the functionally correct result important, but it is alsoprovided that a control signal is output at the correct time.

The two processor cores may have an identical or a different clock.According to one further embodiment, in the case of a different ortime-delayed clock, the device 1 includes an adjustment designed toreduce the time shift of the clocks of the processor core 2 a and/or thefurther processor core 2 b.

In the case of an insufficient similarity between the profile and thefurther profile, any given selection of the following measures may beundertaken: (1) outputting a fault signal or alarm signal as a statussignal 6; (2) performing a restart of the device 1 and/or the component2 and/or a system monitored by the component 2; (3) switching the device1 and/or the component 2 and/or a system monitored by the component 2 toan intrinsically safe state and/or to a restricted operating mode; (4)performing additional checks; and/or (5) deleting, invalidating, orupdating a cryptographic key, e.g., if it is assumed that the key may beknown to an attacker.

As an alternative to the example embodiment depicted in FIG. 1, thedevice 1 does not have to be a multi-processor component, since thefurther processor core 2 b may also be included by a further componentseparate from the component 1.

The processor core 2 a and the further processor core 2 b may beredundantly operable. This means that they are operated in afunctionally identical manner. This has the advantage that the currentconsumptions of the first and second processor cores have a very highcorrespondence during correct operation. The processor cores 2 a and 2 bmay be identical components. Alternatively, the processor cores 2 a and2 b may be different, but functionally identical components, e.g.,processor cores from different manufacturers or processor cores thathave been implemented at different production plants or by differentproduction technologies. This has the advantage that a malfunction ofonly one processor core is detectable. Thus, for example, the case maybe detected where a manufacturer has produced a processor coredefectively or with an unwanted additional functionality (e.g., hardwareTrojan, backdoor). If a defective or unwanted function of this type isused in runtime, this may be detected by the different currentconsumption of the processor core 2 a and the processor core 2 b.

According to one embodiment, redundant components are monitored throughcross-correlation of the current consumption profiles. Any given methodsfor signal processing and pattern recognition are fundamentallyapplicable. Thus, for example, features of the current consumptionprofiles may be extracted with algorithms known from pattern recognitionand may be compared for correspondence.

According to certain embodiments, the correct function of the device maybe monitored without providing special data interfaces on the main CPU,in contrast, for example, to the SPI interface of the main CPU in theInfineon Safety Monitor.

According to certain embodiments, the monitoring may be added withoutrepercussions in the case of available old equipment. Only a currentconsumption sensor is added. A real-time system or safety-criticalsystem, for example, may then be monitored without having to modify themain functionality. The approach is thereby applicable e.g. in the caseof old equipment. The approach is also applicable if an approval (e.g.,safety) is required or an update, (e.g., virus pattern), is notpermissible or practicable.

It is to be understood that the elements and features recited in theappended claims may be combined in different ways to produce new claimsthat likewise fall within the scope of the present invention. Thus,whereas the dependent claims appended below depend from only a singleindependent or dependent claim, it is to be understood that thesedependent claims may, alternatively, be made to depend in thealternative from any preceding or following claim, whether independentor dependent, and that such new combinations are to be understood asforming a part of the present specification.

While the present invention has been described above by reference tovarious embodiments, it may be understood that many changes andmodifications may be made to the described embodiments. It is thereforeintended that the foregoing description be regarded as illustrativerather than limiting, and that it be understood that all equivalentsand/or combinations of embodiments are intended to be included in thisdescription.

The invention claimed is:
 1. A method for monitoring a component, themethod comprising: applying an input signal to a processor core of thecomponent; applying a further input signal to a further processor core;determining a profile of the processor core influenced by theapplication of the input signal to the processor core; determining afurther profile of the further processor core influenced by theapplication of the further input signal to the further processor core;comparing the profile and the further profile, wherein an insufficientsimilarity between the profile and the further profile is interpreted asan indication of a malfunction of the component, wherein, in a case ofthe insufficient similarity between the profile and the further profile,a cryptographic key is deleted, invalidated, or updated.
 2. The methodas claimed in claim 1, wherein a sufficient similarity between theprofile and the further profile is interpreted as an indication of afault-free operation of the component.
 3. The method as claimed in claim1, wherein the profile and the further profile in each case comprise orare a variation with time in a power input or in each case a variationwith time in a current consumption of the respective processor core. 4.The method as claimed in claim 1, wherein the comparison of the profileand the further profile is performed by a determination of across-correlation of the profile and the further profile by a differentfeature extraction.
 5. The method as claimed in claim 4, wherein thecomparison is a comparison of one or more of mean values, peak values,or a frequency spectrum of the profile and the further profile.
 6. Themethod as claimed in claim 1, wherein the insufficient similaritybetween the profile and the further profile is determined by a thresholdvalue.
 7. The method as claimed in claim 1, wherein a time shift betweenthe profile and the further profile is determined, and wherein theinsufficient similarity indicates that a time shift threshold value isexceeded by the determined time shift.
 8. The method as claimed in claim7, wherein the time shift between the profile and the further profile isreduced by an adjustment of a clock of the processor core, a clock ofthe further processor core, or the clock of the processor core and theclock of the further processor core.
 9. The method as claimed in claim1, wherein the component comprises the further processor core.
 10. Themethod as claimed in claim 1, wherein the processor core and the furtherprocessor core are operated redundantly.
 11. The method as claimed inclaim 1, wherein the determining of the profile and the determining ofthe further profile is performed by the component.
 12. The method asclaimed in claim 1, wherein the input signal and the further inputsignal are identical.
 13. The method as claimed in claim 1, wherein theinput signal and the further input signal are coded differently.
 14. Themethod as claimed in claim 13, wherein the input signal and the furtherinput signal have identical content.
 15. The method as claimed in claim1, wherein the input signal and the further input signal are appliedsimultaneously to the processor core or to the further processor core.16. The method as claimed in claim 1, wherein the input signal and thefurther input signal are applied with a time shift to the processor coreor to the further processor core.
 17. The method as claimed in claim 1,wherein the component is switched into an intrinsically safe state. 18.The method as claimed in claim 1, wherein the component is switched intoa restricted operating mode.
 19. A device for monitoring a component,the device comprising: the component to be monitored, the componentcomprising at least one processor core; a further processor core; adetermination unit configured to determine a profile of the processorcore influenced by an input signal applied to the processor core and afurther profile of the further processor core influenced by a furtherinput signal applied to the further processor core; a comparison unitconfigured to compare the profile and the further profile and togenerate a fault signal when a comparison result of a comparison carriedout by the comparison unit is an insufficient similarity between theprofile and the further profile, wherein the device is configured, in acase of an insufficient similarity between the profile and the furtherprofile: to delete, invalidate, or update a cryptographic key.
 20. Thedevice as claimed in claim 19, wherein the comparison unit is configuredto generate no fault signal when a comparison result of the comparisoncarried out by the comparison unit is a sufficient similarity betweenthe profile and the further profile.
 21. The device as claimed in claim19, wherein the determination unit comprises a current-measuring unit ora power-measuring unit for the processor core, the further processorcore, or the processor core and the further processor core.
 22. Thedevice as claimed in claim 19, wherein the comparison unit is designedto carry out the comparison by a determination of a cross-correlation ofthe profile and the further profile or by a different featureextraction.
 23. The device as claimed in claim 22, wherein thecomparison is a comparison of one or more of mean values, peak values,or a frequency spectrum of the profile and the further profile.
 24. Thedevice as claimed in claim 19, wherein the comparison unit is configuredto establish the insufficient similarity of the profile and the furtherprofile by a threshold value.
 25. The device as claimed in claim 19,wherein the comparison unit is configured to determine a time shiftbetween the profile and the further profile, and wherein theinsufficient similarity indicates that a time shift threshold value isexceeded by the determined time shift.
 26. The device as claimed inclaim 25, comprising an adjustment configured to reduce the time shiftof clocks of the processor core, the further processor core, or theprocessor core and the further processor core.
 27. The device as claimedin claim 19, wherein the component comprises the further processor core.28. The device as claimed in claim 19, comprising a further componentthat comprises the further processor core.
 29. The device as claimed inclaim 19, wherein the processor core and the further processor core areredundantly operable.
 30. The device as claimed in claim 19, wherein thecomponent comprises the determination unit or an additionaldetermination component comprises the determination unit.
 31. The deviceas claimed in claim 19, wherein the input signal and the further inputsignal are identical.
 32. The device as claimed in claim 19, wherein theinput signal and the further input signal are coded differently.
 33. Thedevice as claimed in claim 32, wherein the input signal and the furtherinput signal have a same content.
 34. The device as claimed in claim 19,wherein the input signal and the further input signal are applicablesimultaneously to the processor core or to the further processor core.35. The device as claimed in claim 19, wherein the input signal and thefurther input signal are applicable with a time shift to the processorcore or to the further processor core.